A rash dash for your patient data?

Unlike the widely touted (and now delayed) date for lifting all remaining lockdown restrictions, the deadline for patients to opt-out of a scheme to create an unprecedented central database of patient data currently held by GPs went largely unnoticed before campaign groups and journalists picked up on the story.

Details of the data grab – scheduled for 1st July but now pushed back to 1 September – were last month quietly unveiled online and in a leaflet distributed solely in GP surgeries. This is in sharp contrast to the similar but much less ambitious care.data scheme – launched in 2013 but abandoned just three years later – which saw every household in England receive a leaflet about those proposals.

Described by NHS Digital (NHSD) simply as an “improved collection” service which has been welcomed by “respected voices” across the health sector, the latest data grab – known as the General Practice Data for Planning and Research (GPDPR) service and representing a ‘scrape’ of 55m patients’ medical histories – is being presented as an essential upgrade of the existing GP Extraction Service to help the NHS cope with the demands of the pandemic and beyond, and builds on an arrangement already in place that was introduced last year under emergency covid legislation.

But although NHSD claims the new service, allegedly in development for three years, has “been designed to the most rigorous privacy and security standards”, its low-key launch – combined with the current government’s now-default ‘nothing to see here’ stance on most things – has inevitably set alarm bells ringing.

Concerns centre primarily on how much data will be shared. NHSD claims it will not be hoovering up patients’ names and addresses, and that all other data (including diagnoses, symptoms, referrals and information on sex, ethnicity and sexual orientation) from GP records will be ‘pseudonymised’ – using de-identification software to create unique codes – before being shared.

However, NHSD admits it could use the same software to convert those codes back to data that could then directly identify patients “in certain circumstances”. What those circumstances might be are unclear.

And who might access this patient data in the future, and for what purpose, is also hard to pin down.

NHSD already runs a data access request service (DAR) for commercial interests hungry for health service data, and although the accompanying website claims that data cannot be used purely for commercial purposes, and that marketing and insurance firms are unlikely to be granted access, historically the evidence does not inspire confidence.

Private Eye noted this week that in 2014 a government review of NHS data releases found two instances where the recipient was not even recorded, and three instances of material being released to insurance companies.

The DAR website highlights the input of one successful recent applicant – global management consultancy McKinsey – using a case study looking at its work on two hospital contracts.

This is the same company that, according to news site Digital Health last year, was awarded an NHS Test & Trace contract by the Department of Health & Social Care under which it could potentially be granted access to personal data including names and addresses, as well as biometric and medical data, for up to seven years.

With another US firm, data giant Palantir, already working on the health service’s covid ‘datastore’ platform – elements of which may or may not have informed the launch of GPDPR – it’s understandable that the medical profession has concerns over the rushed introduction of the new service and the lack of public awareness of its implications.

The British Medical Association and the Royal College of General Practitioners – both of which NHSD claims to have consulted before unveiling the GPDPR service in May – have urged NHSD to improve its communication efforts relating to the new service, which they have deemed “completely inadequate”, confusing patients and GPs alike during the pandemic.

And in early June 36 GP surgeries in east London agreed to withhold the requested data when collection was due to begin on 1 July.

Shared GP data has nevertheless been used to good effect during the pandemic, for example helping to identify dexamethasone as an effective treatment for covid patients during the Recovery trial, set up as part of the NHS Digitrials programme, jointly run by Oxford University’s Big Data Institute, IBM and Microsoft.

Limits imposed on GP data sharing, conversely, are claimed to be holding back research into a range of conditions such as dementia, arthritis, heart failure and depression, according to a joint statement released on behalf of 120 medical researchers by Health Data Research UK, shortly after the GPDPR delay was announced.

Despite that missed potential, the backlash from professional bodies and privacy groups against the GPDPR service is certainly having an impact, with around 1.5m people indicating they want to opt out of the new programme.

This has led NHSD’s interim chief executive Simon Bolton to warn the service will be rendered less effective the more people drop out, or if people opting out are disproportionately from a specific group.

It may also be behind health secretary Matt Hancock’s unexpected drafting in of Government Statistical Service chief Sir Ian Diamond and Academy of Medical Royal Colleges chair Helen Stokes-Lampard to bolster the GPDPR programme ahead of its September relaunch – a date campaigners still consider far too soon to ensure informed consent.